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We present a number of schemes that use quantum mechanics to preserve privacy, in particular, 
we show that entangled quantum states can be useful in maintaining privacy. We further develop our 
original proposal [see Phys. Lett. A 349, 75 (2006)] for protecting privacy in voting, and examine 
its security under certain types of attacks, in particular dishonest voters and external eavesdroppers. 
A variation of these quantum-based schemes can be used for multi-party function evaluation. We 
consider functions corresponding to group multiplication of TV group elements, with each element 
chosen by a different party. We show how quantum mechanics can be useful in maintaining the 
privacy of the choices group elements. 



PACS numbers: 03.67.Dd, 03.65.Ud, 89.70.+C 



I. INTRODUCTION 

There are many situations in which maintaining the 
privacy of information is important. One example is vot- 
ing; a voter (let us call him Vincent) does not want either 
other voters or the person counting the votes to know 
how he voted. Another possible situation is one in which 
a number of parties want to pool their financial resources 
to purchase, perhaps, a company. They need to find out 
if the total amount of money they have is sufficient, but 
each individual does not want the others to know how 
much he or she has. 

Quantum mechanics has proven to be a useful basis 
of novel communication schemes. In particular, quan- 
tum key distribution uses the laws of physics as the basis 
for a scheme to distribute secure cryptographic keys 
Here we would like to discuss whether quantum mechan- 
ics can be used to protect privacy as well. In particular, 
we shall examine the role quantum mechanics can play in 
voting schemes and in a special form of distributed func- 
tion computation. The elementary primitives for privacy 
are the anonymous broadcast channels. An anonymous 
one-to-many broadcast channel is one in which each of 
the parties can send a message to all of the others, but 
only the person who sent the message will know who 
sent it, i.e. his identity remains hidden to each receiver. 
One solution @, Q is based on DC-nets, which solves the 
so-called dinning cryptographer's problem (originally for- 
mulated by D.Chaum in Ref. [2|), provided that the com- 
munication is secured by a one-time pad. As discussed 
in Refs. 0B| the quantum-based anonymous broadcast 
of classical information does not provide us with addi- 
tional security beyond that provided by classical pro- 
tocols. However, it is possible to anonymously broad- 
cast quantum information, in particular, as is shown in 
Ref. [J, [5| an unknown state of a quantum system (i.e. 
quantum information) can be telcportcd anonymously, so 
that the identity of the sender of the quantum informa- 
tion remains hidden. 



The paper is structured as follows: In Sec. II we review 
the quantum-based voting protocols. In this section and 
the following one, we assume that everyone participating 
in the protocol is honest but curious, i.e. they follow the 
steps of the protocol, but if any extra information comes 
their way, they will have a look. In Sec. Ill, we show how 
voting is a special case of a kind of distributed function 
evaluation. In Sec. IV, we change the adversary model 
and look first at the case of dishonest voters, and then at 
the issue of a eavesdropper who wishes to learn how one 
of the voters voted. We summarize our results in Sec. V. 
A detailed analysis of an attack by a cheating voter can 
be found in Appendix. 



II. ANONYMOUS VOTING 

Let us assume that there are N parties, and they are 
each to vote "yes" or "no" on some question. Besides 
the voters, there is also an authority (let us call her Al- 
ice) who provides the resources for voting and counts the 
votes. Throughout the paper, we shall assume that the 
authority is honest but curious, that is the authority will 
follow the protocol, but if any information is available to 
her, she will have a look. Some desirable features that 
we might want our voting procedure to satisfy are (for 
details see Ref. 0): 

1. Privacy - only the individual voter should know 
how he or she voted 

2. Security - each voter can vote only once and cannot 
change someone else's vote 

3. Verifiability - each voter can make sure that his or 
her vote has been counted properly, but simulta- 
neously cannot prove to anyone else how he was 
voting 

4. Eligibility - only eligible voters can vote. 
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We shall mainly be discussing the first requirement, but 
we shall suggest a method of guaranteeing the second 
requirement as well. The analysis of the other two con- 
ditions is beyond the scope of the present paper. A con- 
siderable effort in classical cryptography has gone into 
designing voting systems, but here we shall only consider 
quantum based approaches. It is important to say that 
the above list of conditions can be extended and there 
are different variations of properties the voting should 
satisfy. Depending on the specified conditions there ex- 
ists unconditionally secure classical protocols, but their 
description is beyond the scope of this paper. 

There have been two quantum-based voting schemes 
proposed independently [1, 0] . The quantum-based vot- 
ing scheme proposed by J. Vaccaro, J. Spring, and A. 
Chefl.es Q makes use of multiparty states whose to- 
tal particle number is definite, but the total number of 
particles possessed by an individual voter is not fixed. 
The votes are encoded in a phase. We shall discuss 
here the schemes originally proposed in our earlier pa- 
per [U, one of which also encodes votes in a phase, but 
in this case each voter has a fixed number of particles. In 
what follows we will study in detail two types of voting 
schemes: A traveling ballot scheme, and a distributed 
ballot scheme. As was mentioned in the Introduction, in 
this section we shall assume that everyone is honest but 
curious, and we will focus on the privacy condition. 

A. Travelling ballot 

Let us first consider the traveling ballot scheme. We 
shall consider N voters (Vincent. 1, Vincent. 2 . . . , Vin- 
cent. N) and an authority to count the votes. The author- 
ity (Alice) begins by preparing the entangled two-qudit 
state (D > N) 

l*> = -il>->a|j>6. (1) 

3=0 

The authority holds the first qudit and sends the second 
one to Vincent. 1. He now performs one of two operations: 
if he wants to vote "yes" , he performs the operation E + , 
where E + \j) = \ j + 1) (the addition is modulo D), and if 
he wants to vote "no" he does nothing (the identity op- 
erator). Vincent. 1 then passes the qudit on to Vincent. 2, 
who makes the same choice and sends it further. Finally, 
Vincent. N sends the qudit back to Alice (the authority). 
The authority's final two-qudit state is 

1 °^ 

\^m) = -^22^)a\j + m) b , (2) 
3=0 

where m is the number of "yes" votes. We have that 
{^ m \^m') = 5 m ,m', so that if Alice measures the final 
state in the basis {l^m^m = 0, ... D — 1}, she will be 
able to determine the number of "yes" votes. Let us note 
a number of things about this scheme. 



1) The privacy is guaranteed by the fact that there is "no" 
information in the state \ ^ m ) about who voted "yes" and 
who voted "no" . In addition, during the entire time the 
second qudit is traveling (before it is returned to the au- 
thority), the reduced density matrices of all voters and 
the authority is p = (1/D)I, where / is the identity ma- 
trix. That means that during the voting process, neither 
the voters nor the authority can determine how the vot- 
ing is progressing. In particular, Vincent. 2 cannot de- 
termine by examining the particle he receives from Vin- 
cent. 1 how he voted. Therefore, the scheme maintains 
the privacy of the voting process. 

2) This is stronger security than that provided by a naive 
classical scheme. In that scheme, a ballot goes from 
voter to voter, and each voter enters into it his vote, 
for "no" and 1 for "yes", plus a random number. At the 
end the ballot goes back to the authority, and everyone 
sends their random number to the authority, who then 
subtracts their sum from the total number on the ballot 
to arrive at the number of "yes" votes. If the random 
numbers remain secret, the scheme insures privacy, but 
if the random number of one of the voters, Vincent. 2, for 
example, becomes known, then the voter who voted just 
before, i.e. Vincent. 1, and the one who voted just af- 
ter him (Vincent. 3) can determine Vincent. 2's vote. The 
quantum scheme does not require the use of secret infor- 
mation, which can become compromised. 

A traveling ballot can also be used for, what was called 
in Ref. an anonymous survey. This can be used to 
compute the average salary of a group of people without 
learning the salary of any individual. One uses a trav- 
eling ballot, and each person "votes" a number of times 
that is proportional to their salary, e.g. one vote means 
10, 000 Euros, two means 20, 000 Euros, etc. The author- 
ity counts the number of votes and divides by the number 
of voters to find the average, but the information about 
individual salaries is available neither to the authority 
nor to the individual voters. 



B. Distributed ballot 

For the case of a distributed ballot the framework is 
the same, i.e. we shall suppose that there are N voters 
and an authority, who counts the votes. The authority 
prepares an entangled iV-qudit ballot state [§] 

l*> = -^Z>^> ( 3 ) 

3=0 

where the states {\j) \j = 0, . . . D — 1} form an orthonor- 
mal basis for the D-dimensional space of an individual 
qudit, and D > N. A single qudit is now distributed 
to each of the voters. In order to vote "no" a voter does 



3 



nothing, and to vote "yes" , he applies the operator 

D-l 

F=J2^ k/D \k)(k\, (4) 

fc=0 

to his qudit. Note that at all times during the voting 
procedure the reduced density matrix of the qudit of a 
single voter is p — (1/D)I, so that he can infer nothing 
about the votes of the other voters. All of the qudits are 
then sent back to the authority, whose state is now (if m 
people voted "yes") 

\* m ) = ^J2e 27rlJm/D \j)® N - (5) 

The states \^ m ) are orthogonal for different values of m 
and hence can be perfectly distinguished. Consequently, 
the authority can determine the number of "yes" votes. 
Note that the states \^ m ) contain no information about 
who voted "yes"; they encode only the total number of 
"yes" votes. Again, voter privacy is protected. 

An interesting variant on this procedure was proposed 
by Dolev, et al. In their scheme, the ballot state 

is locally unitarily equivalent to the state in Eq. ([3]), the 
"yes" vote is described by operation E + (E + \j) = |j + l)) 
and D = N + 1. In particular, the ballot state is 

l*> = 7^=T E \h)...\lN). (6) 

V U ZiH hZ«=0 mod_D 

We define b n = if the n th voter voted "no" and b n = 1 if 
the n th voter voted "yes" , then the state after the voting 
is 

ISO = 7== E \h+b 1 )...\i N +b N ), (7) 

* L> / 1 + ...i N =0 modD 

where the addition inside the kets is mod D. Each voter 
now measures his qudit in the computational basis get- 
ting the outcome Xj — lj + bj containing his vote (bj) 
and a random number (lj) added to it, but these num- 
bers have the property that they add to zero mod D, i.e. 
Y^j lj — modD. Each voter announces the result of his 
measurement and the total sum x — J2j {lj = bj 
gives the result of the voting. That is, each voter adds 
all of the announced results mod Z?, and the result x is 
the total number of "yes" votes. 

This scheme can be modified to perform one-to-many 
anonymous broadcast, sending log£> bits of information. 
Consider N parties sharing the state |<E>), and let the 
sender performs the operation E" 1 . This will result in 
the new state in which the number 1\,12, ...In sum to 
m modD. Measuring in the computational basis and 
publicly announcing the results will enable each of party 
to reconstruct the message to. In a sense this protocol 
provides a quantum solution to dining cryptographer's 
problem [2j. 



III. DISTRIBUTED GROUP MULTIPLICATION 

Maintaining privacy on decision making (e.g., voting) 
can be considered as a part of a more general task - 
multi-party function evaluation. In particular, voting 
and an anonymous survey can be viewed as each partici- 
pant picking a member of a cyclic group with the object 
being to compute the sum of all of the chosen members 
and doing so in such a way that the participants' choices 
are not revealed. We would like to show that a similar 
procedure works for computing the product of group ele- 
ments chosen by the participants for any group. That is, 
voting is just a special case of distributed group multi- 
plication. Throughout this section we shall assume that 
everyone is honest but curious. 

This problem is related to that of secure function eval- 
uation. Suppose that Donna has a device that will eval- 
uate the function f(x,y,z). Alice, who has the input 
x, Bob, who has the input y, and Charlie, who has in- 
put z, would like to know the value of f(x,y,z), but 
each of them wants Donna and the other two partici- 
pants to know as little about their input as possible. In 
fact, ideally Donna would know only as much as she can 
infer from knowing the value of f(x,y,z), and each of 
the other parties would only know as much as they could 
infer from knowing f(x,y,z) and their own input. Note 
that voting is a special case of this problem in which the 
variables take only the values and 1, and the function 
is addition. 

Can something like this be accomplished using 
quantum-based methods? This problem was analyzed 
by H.-K. Lo for the case of two parties (Alice and Bob), 
and he showed that in the case of two-party secure com- 
putations it cannot [l3| . In the two-party case Alice eval- 
uates the function, and she has one input and Bob has 
the other. In one-sided secure function evaluation only 
Alice learns f(x,y) and in two-sided secure computation 
both learn f(x,y). In both cases Alice and Bob are to 
learn as little about each other's input as possible. Lo 
showed that one-sided two-party quantum secure compu- 
tation is, in fact, always insecure, that there are functions 
for which the two-sided scenario is also insecure. 

We would like to start by showing that a modification 
of our traveling ballot scheme will allow us to accomplish 
the task described in the first paragraph of this section for 
a particular function, group multiplication in the Klein 
4-group, and for participants who are curious but follow 
the protocol. This is an order four abelian group whose 
elements we shall denote by {e, x±, X2, x^}. The element 
e is the identity, Xj — e, and XjXk — xi, where j,k, and 
I are all different. Alice, Bob and Charlie each choose 
a group element, and they want to know the product of 
the three elements. Donna prepares the two-qubit state 
|*) = (|0)|1> - |1)|0))/V2, keeps one qubit and sends the 
other to Alice. Based on her choice of a group element, 
Alice then applies an operation to the qubit using the 
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correspondence 



X 2 -> <7y 



Si 

£3 



0"a 



(8) 



where 7 is the identity, and <r x , a y , and a z are the Pauli 
matrices. She then sends the qubit on to Bob, who ap- 
plies an operation to the qubit based on his choice of 
group element (using the same correspondence between 
operations and group elements), and he then sends it on 
to Charlie who does the same. Finally, Charlie sends 
the particle back to Donna. Donna measures the result- 
ing state in the Bell basis, and from this measurement 
she can determine which of the four states she has, 
(7 (g> <r x )|*), (7 <8> (T y )\^), or (7 (g> a z )\^) (each of these 
states is proportional to an element of the Bell basis). 
Using the correspondence between group elements and 
operations she can tell what the product of the group 
operations was. For example, if she found that she had 
(7 ® a x )\^f), then she would know the product was x\. 

This procedure is a variant of dense coding 14]. It is 
based on the fact that the operators {7, a x , (J y , a z } form 
a projective representation of the Klein 4-group. Note 
that during the entire procedure the reduced density ma- 
trix of each of the participants is p — 7/2, so they are 
able to learn nothing about what the other participants 
have done. The final state received by Donna contains 
no information about who did what, it only contains in- 
formation about the product of their choices of group 
elements. 

This scheme can be generalized to any finite group and 
arbitrary number of participants. Let G be a group, and 
g G G — » U(g), where U(g) is a DxD unitary matrix, and 
the matrices U(g) form a 7)-dimensional representation 
of G. Donna starts with the two-qudit state 



I*) 



1 



D-l 



£li)U)- 



(9) 



3=0 



The second qudit is sent to Alice, who acts on it with 
U(g a ), where g a G G is her input, and then sends the 
qudit on to Bob. Bob applies the operation U(gb), where 
gt G G is his input, and sends the qudit on to Charlie, 
who does the same, etc. At the end of the procedure 
Norbert sends the qudit back to Donna who has the two- 
qudit state 7 <g> U(g p )\^), where g p = g a gi, . . . g n is the 
product of the group elements chosen by the parties who 
are providing the inputs. A requirement is that these 
states are orthogonal for different group element, g p , so 
that Donna can distinguish them. This requires that 



(tfllSETGfeV)!*) =0 



(10) 



for any two gi,g 2 G G, such that g\ ^ g 2 . This con- 
dition will be fulfilled if Tr(U(g)) — for any group el- 
ement not equal to the identity. This condition is sat- 
isfied by the regular representation of any group. For 
this representation, which is, in general, reducible, the 
dimension is equal to the order of the group. In order to 



give an explicit description of the matrices U(g) in this 
representation, we order the group elements, gj, where 
j — 0, . . .\G\ — 1. The matrix elements of U (g n ) are then 
given by 



U(g n )jk 



1 if 9j gk = gn 
otherwise 



(11) 



It may be possible to find representations of smaller di- 
mension that satisfy the condition, Tr(£/(g)) = for any 
group element not equal to the identity, but we are at 
least assured that if we choose the dimension equal to 
the order of the group, such a representation exists. 

Note that if we used the regular representation in the 
case of the Klein 4-group, our representation would have 
had dimension four, but we were able to find one that 
has dimension two. The two-dimensional representation 
is, in fact, a projective representation. A projective rep- 
resentation of a group is a mapping from the group to 
unitary matrices, g —¥ U(g), that satisfies 



U(gi)U(g 2 ) = e iu ^<^U(g l92 ), 



(12) 



where U)(jgi,g2) is a real-valued function on G x G. A 
projective representation that satisfies Tr (17(g)) = for 
any group element not equal to the identity will also pro- 
duce states 7® U(g p )\ i S) that are mutually orthogonal. In 
some cases, the use of a projective representation will al- 
low one to achieve this result with a smaller dimensional 
space than would be possible if one restricted oneself to 
standard representations. 

For abelian groups it is also possible to use a dis- 
tributed ballot scheme. This is because any abelian group 
is isomorphic to a direct product of cyclic groups. We 
distribute one particle for each cyclic group appearing in 
the decomposition of the abelian group, and the parties 
apply operators, similar to the voting operators in the 
previous section, to each particle to encode their group 
element. At the end of the procedure, all of the parti- 
cles are returned to Donna, who can then determine the 
product of the group elements. 

Let's illustrate this procedure with a simple example. 
We again consider the Klein 4-group and the parties Al- 
ice, Bob, and Charlie, who are to choose group elements. 
The Klein 4-group is isomorphic to Z 2 x Z 2 , whose el- 
ements can be expressed as {(0, 0), (0, 1), (1, 0), (1, 1)}. 
The following state is prepared 



\j=0 J \k=0 



(13) 



and one qubit from the first triple and one from the sec- 
ond is distributed to each of the three parties. Each party 
now chooses a group element and performs an operation 
on his or her pair of qubits according to the correspon- 
dence 



(0,0) 

(o,i)- 



->7<g)7 (1,0) 

I<S)<T Z (1,1)- 



(14) 
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All of the qubits are then sent to Donna. She measures 
each triple in the basis 

|^) = -^(|0)|0>|0>±|1)|1>|1», (15) 

with a \<fi+) result corresponding to a and a \<j>—) re- 
sult corresponding to a 1. For example, if she obtained 
\4>+) for the first triple and \<j>-) for the second, this cor- 
responds to the group element (0,1). Therefore, she is 
able to determine the product of the group elements cho- 
sen by Alice, Bob, and Charlie without knowing their 
individual choices. 



IV. DISHONEST VOTERS AND 
EAVESDROPPERS 

We now want to change the rules. So far, we have been 
assuming that everyone was honest but curious. Now we 
want to relax that constraint. First, we will look at the 
case of dishonest voters. These voters want to vote more 
than once. We shall present a scheme that prevents them 
from doing that. Another possibility is that all of the 
participants in the voting scheme are honest, but there 
is an eavesdropper who wants to discover how one or 
more of the voters voted. We shall now explore these 
two scenarios. 



A. Dishonest voters 

One problem with the voting schemes presented so far 
is that there is nothing to prevent voters from voting 
more than once. If they want to vote "yes" more than 
once they simply apply the operator corresponding to a 
"yes" vote more than once, if they want to increase the 
number of "no" votes they apply the inverse of the "yes" 
operator. One possible way of dealing with this problem 
was suggested in Ref. @. In this section we will discuss 
variations of the distributed-ballot and traveling-ballot 
that deal with this problem. 

We begin with the distributed-ballot scheme. The bal- 
lot state is the same as in the Eq. ^ . In addition, the au- 
thority distributes to each voter two voting states, which 
are single qudits. The voting qudit corresponding to a 
"yes" vote is in the state \ip(9 y )} and the qudit corre- 
sponding to a"no"vote is in the state \ip(9 n )), where 

\m) = ^J^e^\j), (16) 

3=0 

and the angles 9 y and 8 n are given by 6 y — (2irl y /D) + 5 
and 9 n — (2nl n /D) + S. The integers l y and l n and the 
number < 5 < 2n / D arc known only to the authority. 
The voter chooses the voting particle corresponding to 
his vote, and using a process much like teleportation, is 
able to transfer the state of the voting qudit onto his 



ballot qudit. Because Alice knows l y , l n , and 8 she can 
determine the number of "yes" votes. If a voter tries to 
cheat and measure the values of 9 y and 9 n , he can only 
measure them to an accuracy of order 2ir/D. If he uses 
these measured values to vote, he will introduce errors. 
These errors will show up if the voting is repeated several 
times. If no cheating occurred, then the result will be the 
same each time. If cheating did occur, then the results 
will fluctuate. Therefore, the authority would be able to 
tell if someone is cheating. In order to facilitate voting 
several times, the authority can distribute several ballot 
states to the voters at the beginning of the voting process 
and instruct them to vote the same way on each one. Let 
us now examine this procedure in more detail: 
Step 0: Distribution of states 

Alice distributes the entangled ballot state \^>) described 
in Eq.([3]) and sends to each voter two additional qudits 
\ip(9 y )) and \tp(9 n )). First, we assume that (l y — l n )N < 
D, where, as before, N is the number of voters (Vin- 
cent. 1, Vincent. N). This condition is necessary in 
order that different voting results be distinguishable. As 
previously mentioned, the integers l y and l n and the an- 
gle 6 are not known to the voters. 
Step 1: Voting process 

Depending on his choice the voter (Vincent. X) combines 
either \ip(9 y )), or \tp(9 n )), with the original ballot parti- 
cle, i.e. creates a system composed from the ballot and 
the voting qudits. Then he performs a two-qudit mea- 
surement of the observable R = ^2^ = q rP r , where 

D-l 

Pr = J2 \j + r )b(3+r\®\j)v(j\, (17) 

3=0 

and the subscript b denotes the ballot qudit while the 
subscript v denotes the voting qudit. Registering the 
outcome r the voter applies the operation V r = If, C3> 
Y^j=o \j + r )v{j\ t° the voting qudit. If the voter voted 
"yes" , the state of the ballot and voting state is then (up 
to normalization) 

V r P r \V)\yj(9 y )) = i r£2 e i(D+k-r)e y ^®(N+i) 

\fe=0 

D-l \ 

+ ^ e^-O^fe)®^ 1 ) . (18) 

k—r / 

It is necessary to get rid of the factor exp(iD9 y ) — e lDS in 
the first term. After a voter has voted, he tells (publicly) 
the authority the value of r he obtained, because only the 
authority has knowledge of 6 and can undo this factor. 
Each voter sends both (the ballot and the voting) qudits 
back to the authority. The remaining unused qudit must 
be kept, or destroyed in order to secure the privacy of 
the registered vote. 
Step 2: Reading the result 

When the ballot state is returned to the authority, she 
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applies an operator 



W = 



(19) 



fe=i 



to one of the particles in the ballot state [15J ■ The integer 
rfc is the value of r obtained by the fc th voter, where 



W r \k) = 



- WS \k) 
\k) 



< k < r- 1 
r < k < D - 1 



(20) 



That removes the unwanted phase factors. The authority 
is then in possession of a state consisting of 2N qudits. 
If niy = to voters voted "yes" , m„ = N — m voters voted 
"no" , the authority, after the application of the operator 
W, now has the state 



D-l 



Jj(my6y+m„e„)\j\®2N 



(21) 



where an irrelevant global phase factor has been dropped. 
The phase factor appearing in the sum can be expressed 
as 



(22) 



where A = 6 V - 6 n = 2it(l y - l n )/D. The factor e ijNe " 
can be removed by the authority by applying a unitary 
transformation that shifts \j) to e~^ N6n \j) to one of the 
qudits. This finally leaves the authority with the state 



!«»> = 



1 



D-l 

E< 

3=0 



(23) 



where q = m(l y — l n ). These states are orthogonal for 
different values of q, for q an integer between and D — 1 
(we need to choose \l y — l n \ and D to guarantee that q 
is in this range), so we see that from the state \VL q ) the 
authority can determine the value of q corresponding to 
this state. This allows her to determine to, because she 
knows both l y and l n . Note that q should always be a 
multiple of l y — l n if the voters are using their proper 
ballot states. If after measuring the ballot state, the 
authority finds a value of q that is not a multiple of l y — l n , 
then she knows that someone has cheated. Let us note 
that the total measurement is described by projective 
operations M q = \Q, q )(Q. q \, for < q < D — 1 and a 
multiple of l y - l n , and M erxor = / - M q . 

A similar procedure works for a traveling-ballot 
scheme. In this case, the previous traveling-ballot scheme 
is modified so that votes are recored by means of a ro- 
tation rather than as a shift. We start with the ballot 
state in Eq. (TTJ, and as in the distributed-scheme vot- 
ing particles in the states \ip(9 y )} and \tf)(6 n )) are dis- 
tributed to the voters. We still have 9 y = (2irl y /D) + 5 
and 8 n — (2nl n / D) +6. A voter now combines the ballot 
state with the voting particle representing his choice and 
measures R as before. Suppose he wants to vote "yes" 



and the result r is obtained upon measuring R. The state 
is then 

P r \*m0y)) = ^\Y,e i{D+j - T)<>y \3)am3-r + D) v 



D-l 



(24) 



j=r 



The voter now tells the authority the value of r, and the 
authority applies the operator W r to the particle in her 
possession. This removes the unwanted factor of e lD6y in 
the first term. The voter now applies the operator U r to 
the ballot and voting particle, where 



D) 



3)b\0) v , 



U r \j)b\j + r 
for < j < r — 1 , and 

U r \j)b\j-r) v = \j) b \0) v 



(25) 



(26) 



for r < j < D — 1 . This has the effect of disentangling 
the voting particle from the rest of the state, 



U r W r P r \*)W(6y)) = ± 



, e 



\j)a\3)l 



+ Efjr 1 e tU - r)9 *\3)a\3) b ) 10)427) 



The ballot particle is now passed on to the next voter, 
who repeats the procedure. At the end of the voting, the 
ballot particle is returned to the authority, who then has 
the state 



D-l 



= r/(mj,e y +m„e„) 



\j}a\j}l 



(28) 



3=0 



up to a global phase factor. From there on the analysis 
is the same as in the distributed ballot case. 

As we discussed at the beginning of this subsection a 
voter who wants to vote more than once is faced with 
the problem of determining what 9 y or 8 n are, and this 
cannot be done from just a single state. However, there 
is a small chance that the cheating won't be detected and 
therefore, the voting has to be performed several times. 
However, just a single difference in outcomes means that 
someone is cheating. The details of an attack by a cheater 
and its consequences are described in Appendix. 



B. Eavesdropper 

Now we shall consider an attack by an external eaves- 
dropper, who wants to learn how one of the participants 
voted. The actual participants in the protocol are as- 
sumed to be honest but curious. 

First, let us consider the traveling-ballot scheme. Sup- 
pose an eavesdropper, Eve wants to know how the second 
voter, Vincent. 2, voted. She intercepts the ballot qudit 
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just before it is due to be received by Vincent. 2 and sends 
it on to Vincent. 3. To Vincent. 2 she sends her own qu- 
dit, which is in the state |0). After Vincent. 2 votes, she 
intercepts the qudit and measures it; if it is in the state 
|0), Vincent. 2 voted "no", if it is in the state |1), then 
Vincent. 2 voted "yes". This type of attack seems to be 
very hard to prevent. One possibility, which is very ex- 
pensive in terms or resources, is to use teleportation. If 
successive voters share entangled two qudit states of the 
form given in Eq. (JT]), they can then teleport the ballot 
state to each other rather than physically send the ballot 
particle. This procedure would prevent the of man-in- 
the-middle attack just described, but requires that the 
participants originally shared many qudit pairs and used 
entanglement purification to bring any correlations with 
outside systems, such as those possessed by an eavesdrop- 
per, to acceptable levels. Therefore, this approach is not 
a particularly desirable one. 

A distributed-ballot scheme seems to offer more pos- 
sibilities. In order to illustrate this, we shall compare 
the vulnerability of a classical and a quantum scheme to 
eavesdropping. We shall consider the case in which there 
is an eavesdropper, Eve, who wants to find out how Vin- 
cent. 1 voted. 

Our classical scheme is a variant of one proposed in 
the paper by Dolev et al. |Ioj |. There are two authorities, 
one who generates ballots and one who counts the votes, 
and there are N voters. The first authority generates N 
ballots, one for each voter, and on each ballot an integer 
between and N is written. These numbers have the 
property that their sum is equal to zero modulo N + 1. 
When each voter receives his ballot, he does nothing to 
vote "no" and adds 1 to vote "yes." The ballots are all 
sent to the second authority, who simply adds all of the 
numbers modulo N + 1 , with the result being the number 
of "yes" votes. 

The second authority does not know how any of the 
individual voters voted, because she does not know the 
original integers written on the ballots. If fact, she has 
no information about how the voters voted, if each set of 
ballots (that is, each sequence of N integers whose sum 
is zero modulo N + l) is equally likely. We can see this as 
follows. We can represent the initial state of the ballots 
by a sequence of N integers, each of which is between 
and N and whose sum is zero modulo N+l. Similarly, we 
can represent the final state (after voting) of the ballots 
by a sequence of N integers, each of which is between 
and N and whose sum is m modulo N+l, where m is the 
number of "yes" votes. The set of voters who voted "yes" 
can be represented by a sequence of ones and zeroes, ones 
denoting the voters who voted "yes," of length N. Now 
for each sequence of ./V integers whose sum is equal to 
m mod N + l, and each sequence of length N consisting 
of to ones and N — m zeroes, there is a sequence of N 
integers whose sum is mod N + 1( found simply by 
subtracting the second sequence from the first). Thus 
with no knowledge of the initial ballot set, all we can 
conclude from a final ballot set whose numbers sum to 



m mod N + l, is that some subset consisting of m voters 
voted "yes." Therefore, the voting information, that is, 
who voted how, is protected from the curiosity of the 
authorities. 

Now let us add the eavesdropper. Eve wants to know 
how voter number 1 (Vincent 1) voted, and she has an 
excellent method of doing so. She intercepts the ballot 
going to Vincent 1, records the number on it, and sends 
the ballot on to him. Vincent 1 votes, and Eve again 
intercepts the ballot, notes the result, and sends it on 
to the second authority. Eve now knows how Vincent 1 
voted, and her intervention has not been detected. 

Next let us consider the quantum scheme. The ballot 
state is the N qudit state given by Eq. ((3J. We shall 
assume that the same authority prepares the ballot state 
and later measures it to count the votes. As before, a 
qudit from the ballot state is sent to each voter, and if 
they wish to vote "no," they do nothing, and if they wish 
to vote "yes," they apply the operator F. 

Let us now suppose that Eve wants to determine how 
Vincent 1 voted and not be detected. One way of doing 
this is the following. Eve intercepts ballot particle 1 on 
its way to Vincent 1 and entangles it with an ancilla. In 
particular, suppose the ancilla is a qudit initially in the 
state 

* k=0 

and the entangling operation is the swap operator, 
U SW ap\k)E ® |i)i = \j)e ® After this is done, the 

ballot plus ancilla state is 

fc=0 j=0 

After the voting, the state becomes 

D-1D-1 

|*") = - E E e 2 " roifc / D e 27rim ^|^ B | fc ) 1 | J -)®(Ar-i) ) 

fc=0 j=0 

( 31 ) 

where 777,1 = 0, 1 is the vote of Vincent 1 and m is the sum 
of the rest of the votes. Now, Eve again intercepts ballot 
particle number 1 on its way to the authority and again 
applies the swap operator to particle 1 and the ancilla. 
The state of the system is now 

(D-l \ D-l 

I*'") = - E e 2mmik/D \k} E £ e Mmi/D \j) 1 \j)®t N - 1) . 

\k=0 J j=0 

(32) 

Now Eve can measure the ancilla particle to determine 
mi. Once she has done so, she applies the appropriate 
operator to particle 1, nothing if m\ — and F if mi = 1, 
and sends the particle to the authority. At this point she 
knows how Vincent 1 voted, and her presence has not 
been detected. 
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So far, the quantum scheme seems just as vulnerable 
as the classical one. We can defend against the kind of 
attack discussed above by adding an additional element. 
Before the voting occurs, the voters are divided up into 
pairs. Who is in which pair is not public knowledge. 
This can be accomplished if the authority and voters 
share a secure key. This would allow the authority to 
tell each voter with whom they are paired in a secure 
fashion. The voters in each pair must come together, 
perhaps at a polling place, where they can perform a 
joint measurement on their ballot particles. If there has 
been no tampering, these measurements do not change 
the state of the system, and the voting proceeds as usual. 
If the measurements detect tampering the procedure is 
aborted. One could group the voters into larger sets and 
perform correspondingly larger collective measurements. 
Pairs minimizes the complexity of the collective measure- 
ments, and it means that each voter has to meet with only 
one other voter to perform the collective measurement. 
It is important that Eve not know which voters have been 
assigned to the pairs. If she did, she could perform an 
attack using swap operators on a pair, which is very sim- 
ilar to the attack discussed above, and learn how the pair 
voted. Using this attack, she would, however, not learn 
how an individual voted. 

Having the some of the voters come together is awk- 
ward, but for the type of check we are discussing it seems 
to be necessary. The basic idea is that if Eve wants to 
determine how an individual, or set of individuals, voted, 
she has to break the symmetry of the ballot state. In or- 
der to detect this, the voters have to test the symmetry 
of the ballot state, and this seems to require a collective 
measurement. An alternative would be to use teleporta- 
tion, and have one member of a pair teleport the state of 
the ballot particle to the other member of the pair, who 
could then perform the collective measurement and tele- 
port the particle back if the measurement was successful. 
This would be, however, very expensive in terms of the 
number of entangled pairs required. 

In order to examine this type or eavesdropping attack 
in detail, let us suppose that one of the pairs consists 
of voters 1 and 2. When they receive their ballot parti- 
cles, they perform the measurement corresponding to the 
projection operator 

D-l 

Pi2 = 5>-)i01®li>201- (33) 

3=0 

If they get 1, they proceed to voting, if they get 0, they 
abort the procedure. 

Now suppose that an eavesdropper, who wants to find 
out how voter 1 votes, has intercepted the ballot particle 
destined for voter 1 and entangled it with an ancilla in her 
possession, and then sent the ballot state on to voter 1. 
We assume that the entanglement has been accomplished 
by means of a unitary operator J7bi(|0)e® = \4>j)Ei- 



The state of the N voters plus the ancilla is now 

i* / ) = -^Ei^®iJ') 8(Ar " 1) - ( 34 ) 

V 3=0 

Eve's plan is to measure the ancilla after the voting has 
occurred to gain information about how voter 1 voted. 
The probability of not detecting the eavesdropping is just 
{^'\Pi2\^'), which can be expressed as 

1 

<*'| W) = ^ E eM{Ie ® IMM^ei, (35) 

3=0 

where Ie is the identity on the ancilla space. Eve would 
like this quantity to be equal to 1, i.e. she does not 
want to be detected. For that to be true, we must have 
\</>j)Ei = \Vj) e ® \ for some ancilla states 1 77^ ) . If this 
is the case, the state after the voting has taken place is 

I*") = J^ eW/D \Vj)E ® \j)® N , (36) 
j=o 

if m voters voted "yes." Tracing out all of the voters 
except for voter 1, we find that the density matrix for 
voter 1 and the ancilla state is 

1 °~ l 

p ei = d E toj-MtylslihOI, (37) 

which contains no information about the votes. That 
means that even if Eve intercepts ballot particle 1 after 
the vote and performs an entangling operation on it and 
the ancilla, she will learn nothing about the vote. So, if 
the eavesdropper is undetectable, she gains no informa- 
tion about the voting, and if she gains information about 
the voting, she can be detected. 

Note that even in the general case when \4>j)ei is not 
a product state, if voters 1 and 2 obtained one when they 
measured P12, then it will be after the measurement. 
This follows from the fact that (Ie S3 \i)i(i\)\4>3) ei = 
\^j)e® \j)it where \hj)e is an unnormalized ancilla state. 
Then the density matrix for the ancilla and particle 1 
will look the same as in Eq. ([3"T]) except that \rjj) will be 
replaced by and there will be an overall normal- 

ization factor. It still does not contain any information 
on the voting. 

Finally, let us find the probability of Eve being de- 
tected in the scheme that made use of the swap operator. 
A short calculation shows that the probability of Eve not 
being detected is 

<*'| W) = ^, (38) 

so that the probability of her being detected is 1 — (1/D). 
Therefore, it is quite likely that this type of tampering 
by Eve will be detected. 
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V. CONCLUSION 

Wc have shown how quantum mechanics can be of use 
in maintaining privacy in tasks such as anonymous vot- 
ing and in a special case of multi-party function evalua- 
tion. The voting scheme we described was introduced in 
Ref . Q . In this paper we provide a more detailed discus- 
sion of that scheme, including a more detailed analysis 
of some aspects of its security. 

The schemes presented here need much more exami- 
nation in order to determine how secure they are under 
different kinds of cheating and eavesdropping attacks. It 
could be the case that quantum resources themselves will 
not provide us with any additional feature that will result 
in more effective and secure anonymous voting protocol. 
However, it is useful to think about how quantum re- 
sources can be applied to such complex problem. Such 
efforts can bring results that can potentially enhance pri- 
vacy in less complex cryptographic tasks. We hope that 
what has been presented here will provide a framework 
for thinking about these issues. 
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Appendix A: Cheating by multiple votes 

Let us look at cheating in more detail. We shall as- 
sume that one of the voters, whom we shall call Vin- 
cent. X, is dishonest, and that he wants to vote "no", 
and in addition he wants to replace "yes" votes with 
"no" votes. He employs a measurement to determine 
9 y and 9 n , which is described by the POVM operators 
E(6) = (D/2-k)\®{6)){<&{9)\, where 



Me)) 



1 



This is a phase estimation measurement, and the prob- 
ability distribution for the measurement result 9 in the 
state is p{9) = (ip\E(9)\ip). If Vincent.X obtains the 



values 9' y and 9' n from his measurements of the voting 
particles, the probability distributions for these results 



2ttD 



D-l 
3=0 



pM) = m n )\E{e' n me n )) = 



2nD 



D-l 

£< 

3=0 



Note that these functions are peaked about the values 
By and 9 n , respectively. In order to vote "no" Vincent.X 
prepares a particle in the state \ip{9' n )) and carries out 
the usual voting procedure with it. He then applies the 
operator 



D-l 
k=Q 



\k)(k\, 



to his ballot qudit s times, which has the effect of remov- 
ing s "yes" votes and adding s "no" votes. He then sends 
his ballot and voting qudits back to the authority. 

We want to see how Vincent. X's cheating affects the 
measurement the authority makes to determine the num- 
ber of "yes" votes. We shall assume, for the sake of sim- 
plicity, that Vincent.X is the last person to vote, and that 
m y of the previous voters voted "yes" , and m n voted no, 
where m y + m n = N — 1. The order in which the voters 
vote makes no difference to the final result, so this as- 
sumption is made for the sake of notational convenience. 
In addition, we shall also assume that the other voters 
have reported their results from measuring the observable 
R, and that the necessary corrections have been applied. 
This means that the state of the ballot and voting parti- 
cles just before it reaches Vincent.X is 



1 D ~ 1 

3=0 



e ij(m v e v +m„6n)\j\®(2N-l)_ 



As stated in the previous paragraph, Vincent.X now pre- 
pares a qudit in the state \ip(9' n )} and applies the usual 
voting procedure. Let us suppose that when he measures 
the observable R he obtains the value r. After he ap- 
plies U(9' y ,9' n ) s times the state of the ballot and voting 
particles is 



1 r_1 

e i(D+j-r)0' np isj 

Id ^ 

7 3=0 



D-l 



{s' n -e' y ) e ij{m y e y +m„e n )i-\mN , _J_ 



g*(j -r)8' n e isj(O' n -0' y ) & ij (m v v +m n 



3=r 



This is the state possessed by the authority (Alice) after the ballot and voting particles have been returned to her. 
Alice now uses Vincent. X's measurement result, r, to correct the state. After having done so, and after removing 
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unimportant phase factors, the authority has the state 

r-l 

p iD(e' n -S) 

'D 



3 3 ) = J_ e ^(e;-«)^ e ijWe;-e;)+mA+e;-0„]|^(gi2iv 



D-l 



j=0 



®2N 



where A = 9 y — 9 n and we have set m = m y . 

Alice now measures the state IS3) in the |f2 q ) basis [see Eq. (PZ5|) ] in order to determine the number of "yes" votes. 
If there were no cheating she would find q = m with certainty. With cheating, however, this is no longer the case, and 
this is what tells Alice that cheating has taken place. The voting is repeated several times, and if she finds different 
values of q, then she knows cheating has taken place. In order to find the probability distribution for q assuming that 
Vincent. X measured r for the observable R and that m people voted "yes", which we shall denote by p(q\r,m)), we 
first note that the probability that the authority finds the value q given that Vincent. X measured the values 6' y , 9' n , 
and r, and that m people voted "yes" is given by 



p(q\r, 



m,e' y ,e' n ) = \(n q \z 3 )\ 2 = i- 



e iDK-6)J2e 
3=0 



iine' n -e'y)+e' n +4>] 



D-l 



where (f> = mA — 6 n — (2irq/D). We then have that 



p{q\r, m) 



271 



dd' 



2tt 



dO'j?(q\r,rn,6'6' n )p y (6') Pn (6' n ) 



Let us consider a particular case in which D = N + 1, l v = 1, l n = 0, and s > D/2. This choice of s is one that 
Vincent. X might make if he thought that that there will be a majority of "yes" votes, and he wants to make sure that 
the measure being voted upon loses. One then finds that 



p(q\r, m) 



1 

D 



1 



2{D - s)[{D - 2){D - s - 1) + (s + 1)] 
D 3 



cos[27r(rn — s — q)/D] 



Note that while this distribution has a maximum at q = several times she will find a spread of values, showing her 
m — s, which is the result Vincent. X desires, it is very that someone is cheating, 
broad. That means that when the authority measures q 
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